SSH_AUDIT_UNKNOWN
{SSH_AUDIT_UNKNOWN, "AUDIT_UNKNOWN"}
for (i = 0; event_lookup[i].event != SSH_AUDIT_UNKNOWN; i++)
return SSH_AUDIT_UNKNOWN;